diff options
| author | Pierre Riteau <pierre@stackhpc.com> | 2022-01-13 22:35:27 +0100 |
|---|---|---|
| committer | Pierre Riteau <pierre@stackhpc.com> | 2022-01-13 22:35:27 +0100 |
| commit | 448e4f56aa6218a66b0074329d322c0b6089b2e6 (patch) | |
| tree | 6f4ea88f87e9be67f4c250493f059fdf4f22a797 /releasenotes | |
| parent | 788e340f37f95a7406aa619fbff797c97348134c (diff) | |
| download | kolla-448e4f56aa6218a66b0074329d322c0b6089b2e6.tar.gz kolla-448e4f56aa6218a66b0074329d322c0b6089b2e6.zip | |
Mitigate two Log4j vulnerabilities in Apache Storm
The Log4j version was bumped on GitHub [1] but it is still pending
inclusion in a release of Apache Storm.
Apply the alternative mitigation recommended by Log4j [2] of removing
the JndiLookup class from the classpath.
[1] https://github.com/apache/storm/pull/3427
[2] https://logging.apache.org/log4j/2.x/security.html
Change-Id: Ib3ecd73f9e39e320acb2c5f0962b8af9b1a817e9
Diffstat (limited to 'releasenotes')
| -rw-r--r-- | releasenotes/notes/storm-log4j-vulnerability-mitigation-6746a8a0bb329485.yaml | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/releasenotes/notes/storm-log4j-vulnerability-mitigation-6746a8a0bb329485.yaml b/releasenotes/notes/storm-log4j-vulnerability-mitigation-6746a8a0bb329485.yaml new file mode 100644 index 000000000..5126662ad --- /dev/null +++ b/releasenotes/notes/storm-log4j-vulnerability-mitigation-6746a8a0bb329485.yaml @@ -0,0 +1,5 @@ +--- +security: + - | + Adds mitigation for Apache Log4j 2 Remote Code Execution (RCE) + vulnerabilities CVE-2021-44228 and CVE-2021-45046 to Apache Storm. |